CVE-2026-79748

MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, contains a command injection vulnerability in the POST /api/servers and PUT /api/servers/:name endpoints prior to version 0.12.15. These endpoints spawn configured stdio processes via child_process.spawn but lack a...